# Missing overflow check in flashLoan

NFTX ERC20FlashMintUpgradeable.flashLoan lacked overflow check on amount+fee, letting borrowers burn 0 tokens and skip repayment if fee were nonzero.

- Payout: Audit contest
- Severity: high
- Program: NFTX
- Disclosed: 2021-06-21
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-05-nftx-findings/issues/43
- Library page: https://bugbountylibrary.com/r/c4%3A2021-05-nftx%3AH-01
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:flash-loan

**Target:** ERC20FlashMintUpgradeable.flashLoan (Solidity contract)
**Root cause:** flashLoan adds fee to amount without SafeMath on pre-0.8 Solidity, so a crafted amount+fee overflows and _burn receives a wrapped small value.
**Steps:**
1. Call `flashLoan` with an `amount` such that `amount + fee` overflows uint256 (requires nonzero fee).
2. Contract executes `_burn(address(receiver), amount + fee)` which wraps to a tiny/zero value.
3. Repay far less than borrowed, keeping the borrowed tokens as profit.
**How found:** Code review of flashLoan against EIP-3156 reference; noticed the reference relies on Solidity 0.8 overflow checks while NFTX used an older compiler without SafeMath on the amount+fee addition.
**Exploitation:** Attacker borrows via flashLoan with an amount chosen to overflow when fees are added; the burn wraps to ~0, so repayment accounting is bypassed and the attacker keeps the borrowed funds. Not currently exploitable because fee is 0.
**Insight:** When a contract copies an EIP reference implementation, check whether the reference's safety depends on compiler-level checks (0.8.x) that the fork's older pragma lacks; arithmetic in fee/repay paths is the classic gap.